CVE-2022-1999

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under certain conditions, using the REST API an unprivileged user was able to change labels description.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-20007.8Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.CVE-2022-200017.8fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contaCVE-2022-200027.8In incfs, there is a possible way of mounting on arbitrary paths due to a missing permission check. This could lead to local escalation of pCVE-2022-200047.8In checkSlicePermission of SliceManagerService.java, it is possible to access any slice URI due to improper input validation. This could leaCVE-2022-200057.8In validateApkInstallLocked of PackageInstallerSession.java, there is a way to force a mismatch between running code and a parsed APK . ThisCVE-2022-200067.0In several functions of KeyguardServiceWrapper.java and related files,, there is a possible way to briefly view what's under the lockscreen CVE-2022-200077.0In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app that believes it's stiCVE-2022-200084.6In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local inCVE-2022-200096.8In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check. This could lead to CVE-2022-20018.8The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due toCVE-2022-200106.5In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote CVE-2022-200115.5In getArray of NotificationManagerService.java , there is a possible leak of one user notifications to another due to missing check. This co
CVE-2022-1999: Medium severity, CVSS 5.3 | Vulnix